RE: Strange entries from AS1 in global table

[James Sink <james.sink () freedomvoice com>]

That's correct, I have seen L3 use that for MPLS as recently as a few months ago. 
-James

-----Original Message-----
From: Brad Fleming [mailto:bdflemin () gmail com] 
Sent: Thursday, August 08, 2013 7:49 AM
To: Humberto Galiza
Cc: NANOG Mailing List
Subject: Re: Strange entries from AS1 in global table

I think Level(3) uses it for at least some L3 MPLS VPN stuff. We peer with that AS for dedicated SIP service transport 
for example.


On Aug 8, 2013, at 5:25 AM, Humberto Galiza <humbertogaliza () gmail com> wrote:

> Looking at our routers I can see this:
> 3549 3356 26114 1 i
> 12956 1239 23520 23383 1 ?
>
> but neither 26114 or 23383 are Brazilian ISP´s. Anyway, I guess it´s 
> probably leaked routes or even use of AS 1 as private one (I don´t 
> think level3 guys are using this AS anymore...).
>
> Cheers,
> Humberto Galiza
>
>
> 2013/8/4 Anurag Bhatia <me () anuragbhatia com>:
> > Hello everyone
> >
> >
> > I was looking at global IPv4 table and saw some strange entries from AS1.
> > As per ARIN whois AS1 seems to be with Level3 but I noticed few 
> > prefixes of Brazil based ISP - Netvip
> >
> >
> > http://bgp.he.net/AS1#_prefixes
> >
> >
> >
> > Looking at any prefix in detail, it seems like there are multiple 
> > ASNs announcing same prefix.
> >
> > E.g 177.185.96.0/24 - is being announced by AS1 as well as AS52931 
> > (Netvip's allocated ASN). Same is true with 177.185.98.0/24, 
> > 177.185.98.0/24and so on.
> > http://bgp.he.net/net/177.185.96.0/24
> >
> > So seems like AS1 acting like a mirror for all announcements of 
> > AS52931. To see who exactly gave "transit" to AS1 by Netvip in 
> > Brazil, I checked Oregon and noticed these routes:
> >
> > 3356 3549 16735 52931 1 i
> >
> >
> >
> > Seems like AS52931 itself is acting as transit for AS1 (and AS16735 
> > which seems like a backbone ISP in Brazil) is not filtering these 
> > routes further passing to Level3 (AS3549+AS3356).
> >
> >
> >
> > I am curious to know what could be possible reason for an ASN like 
> > AS1 acting in exact mirror of AS52931? Could it be a case of internal 
> > use of
> > AS1 (assuming it to be private ASN)? May be it's a case of leaked 
> > internal routes?
> >
> >
> >
> > Appreciate your time & answer.
> >
> >
> >
> > Thanks.
> >
> > --
> >
> > Anurag Bhatia
> > anuragbhatia.com
> >
> > Linkedin <http://in.linkedin.com/in/anuragbhatia21> | 
> > Twitter<https://twitter.com/anurag_bhatia>
> > Skype: anuragbhatia.com